Posted
by
timothy
on Tuesday September 15, 2009 @01:08AM
from the good-of-the-tribe dept.

bennyboy64 writes "Australia's Internet Industry Association has put forward a new code of conduct that suggests ISPs contact, and in some cases disconnect, customers that have malware-infected computers.
'Once an ISP has detected a compromised computer or malicious activity on its network, it should take action to address the problem. ISPs should therefore attempt to identify the end user whose computer has been compromised, and contact them to educate them about the problem,' the new code states. The code won't be mandatory, but it's expected the ISP industry will take it up if they are to work with the Australian Government in preventing the many botnets operating in Australia."

True, except for one tiny little detail: all the crap the infected/zombie machines spew out wastes bandwidth on the net and slows things down for the rest of us -- as well as trying to infect other machines. Not to mention the spam, DDoS-ing, and other jackassery going on.

ISPs regularly portscan connected clients to make sure that they aren't running a server in violation of the TOS... many large ISPs have terms of service that strictly forbid running such servers, and even the ones that don't have that prohibition will usually keep tabs on their users to see what they're running.

More than portscanning, they also monitor which ports account for the bulk of your traffic. If you're putting out more than 50MB/day average on port 25, it's a fairly safe bet that it's more than just personal e-mail use. Many large ISPs will also silently redirect all port 25 traffic directly to their own mail server, and some of htem won't be so silent about it, and will simply block outbound port 25 to anything other than their mail servers. When all outgoing mail has to go through their servers, it's pretty easy for them to check attachments for viruses.

Beyond active scanning, there's also abuse reports... those actually do get read, and if they have the appropriate information, then they can very easily be used to track down the user who's infected with a virus.

None of the methods are going to detect a user's virus infection the moment they're infected, but taking a few proactive steps as well as taking proper reactive steps can allow the ISP to pick up on suspicious activity, and to work with the user to clean things up.

Obligatory disclaimer: I used to work for an ISP that did exactly this. We would portscan our users, we would monitor their mail traffic for viruses, and we'd actively monitor the abuse mailbox. When we detected a virus-infected user, we'd send them an e-mail notifying them that they were infected. If they hadn't cleaned up or replied to the e-mail within 5 business days, we'd phone them, and if there was no response within 5 days of that, we'd segregate their connection so that the only sites they could navigate to were the company website, and several notable antivirus sites (McAfee, Norton, AVG, Avast, PC-Cillin). I suspect that the Australian policy described here will work very much the same, and I don't really understand why people are up in arms about it. There's other methods to deal with BitTorrent besides defining it as "malicious" and "viral" (traffic shaping anybody?), and besides that, most piracy these days doesn't even happen through bittorrent. Direct downloads + hjsplit, rename file extensions. They can't really know what's being downloaded, and they can't throttle direct downloads because it'd piss off their customer base.

Nudity is not porn except in the minds of mentally ill persons. And yet oftentimes mere possession of a naked photograph, even it's of your own family or yourself, will land you in jail. Witness the American students who were charged with child porn because they used their phones to shoot themselves without clothes. Why is taking a photo of yourself illegal??? It's stupidity. It's anti-liberty. Worse - fear of nude bodies is a psychological disease, and I suspect Conroy is patient zero.

The problem is the Australian government are already trying to censor our internet connections at the ISP level and whilst getting rid of bot nets sounds like a great idea, building any sort of traffic monitoring in now sounds dangeroulsy close to their existing plan to filter the net.

Hell, this could even be their plan, bring in filtering to take down bot nets then slowly but surely start to block porn they don't like and pro-abortion web sites and before you know it any political site not to their liking

"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all." - H L Mencken

Of course this is dicey, as the current proposition is, in my opinion a good idea. But we all know that GP's right.

"The GP is right"??? Okay. And while we're at it we should advise women to stop wearing clothes cut above the knee, or more than 2 inches below the neck. Plus we should punish people who leave their car doors unlocked. Also we should punish people who have regular windows on their homes instead of unbreakable windows.

Point - This proposal strikes me as blaming the victim. It's not a woman's fault she got raped, just because she wore revealing clothing. It's not the car or home owner's fault somebody b

It's quarantine. If a person gets sick with a contagious disease, it may not be their fault and you probably don't want to punish them. But for public safety, you do need to contain them until they are no longer dangerous to others.

The same applies to sick computers. If it is spewing viruses and malware then stop it, whether the person who owns it was doing it intentionally or not. You can forward all traffic to a local ISP web sight that informs them of the problem and directs them to appropriate ISP approved scanning software or other solutions available within the quarantine zone. If the user does not trust the ISP, fine. They can go clean their machine themselves.

Whether you trust the ISP/Government to have the right motive is a separate issue. But quarantine is an established procedure for humans, and it's not that different here.

The Aussie Government has both good and bad ideas WRT the internet. On the good side, is genuine broadband via a new fibreoptic backbone at an estimated cost of 43e9 dollars. On the bad side is the excretable idea of mandatory filtering. (Which can easily be circumvented... thus making those who do wish to view kiddie porn even more anonymous!)

Having said all that, it is NOT the Aussie government advocating this action! Perhaps the errant public would be well served by their ISP informing them that their machine is infected. As it stands, I see machines that are "typhoid Mary's", So infected with trojan's, virus's and other malware that it is amazing they still work at all. The average user doesn't have a clue there is a problem beyond complaining that their machine is slow. (Which is often why they "upgrade" to a "faster" machine! Seems very fast until the new machine gets infected... takes about a week!)

I'm surprised that the ISPs don't do this already. When one of my family members connected an infected PC to my home network my (UK) ISP promptly contacted me to tell me that the network was a source of malware attacks and to sort it or they would disconnect me. For which I was grateful, and I helped the family member resolve the problem.

Can't Nastyware authors detect which ISP you have? Presuming so, it just leads to another Phish attack. Combined with the completely abusive recordings their LEGIT tech support has, you get this:

"Hello, this is ________. Your account details need to be updated because we think you have malware on your computer. Have you rebooted your computer? Rebooting your computer can help remove local events in a browser that are slowing your machine down. Once you have rebooted your computer, stay on the line and an ac

I think this is a dumb idea. ISPs shouldn't have to cover for Microsoft's insecure software. Why not require that everyone connected to the Internet use a better OS? That idea makes just as much sense, doesn't it?

Worse is that this can so obviously be used as a wedge to demand that ISPs do copyright policing, obscenity policing, and who knows what else.

Throttling based solely on quantity of traffic coming from a customer seems a simpler, fairer, less politically exploitable method.

Instead, you'll need a license to run a peer-to-peer protocol.* Any traffic from an "unlicensed application" will be assumed to be malware and thus blocked. That way, only "authorised" applications from vendors who have paid for a license will work. How many of those will be things like "iTunes" and how many things like "BitTorrent"...?

(*Just because I'm paranoid doesn't mean they aren't out to get us...)

RTFA - They said if the ISP Knows a customer is using a malware infected PC; Working for an Australian (Adelaide) ISP at one point, I can tell you - this is the easy part, We don't have to monitor ports or anything - just wait for somebody to send an email to postmaster/abuse/etc on our domain complaining about spam from specified IP in our range.

Find the customers session - call them, tell them its malware, etc

Protip: Adelaide ISPs pretty much do this already; having your subnet blocked from sending email

I agree with the parent. One of the major issues with Malware is that it cannot be detected locally. As much at it gives me the creeps, detecting Malware from a third party location, like an ISP is definitely a feasible solution, especially when dealing with non savvy end users.

I think its more a gateway for the gov giving isp's the nod to look for a set of streams.
Over time it will be for the worst of the worst.
Then packet inspections will just be part of everyday internet usage.

That's true but I didn't mean specifically by lowering bandwidth usage, I meant by being more stealthy. What if there was some way for your malware to make itself look like some other kind of high-bandwidth usage like usenet, bittorrent or video streaming traffic. Not sure if it's possible because ultimately you need to end up as SMTP at some point.

Anyway, no doubt these kinds of traffic are things that ISPs will eventually want to flip the kill switch on too.

I pretty much agree - but the ISP's already monitor traffic for a variety of reasons. Mostly bad reasons, but the monitoring is in place. It really isn't hard to determine that a machine's excessive traffic is due to viral infections. Shutting them down seems like a good idea. When the customer calls to complain, tech support has a kindergarten teacher on hand to explain how simple it is to upgrade to a safe unix-like operating system to avoid future infestations.

When the customer calls to complain, tech support has a kindergarten teacher on hand to explain how simple it is to upgrade to a safe unix-like operating system to avoid future infestations.

What's wrong with the tech support monkey teaching them how to set up a restricted account for every day use? Why couldn't they instead tell the user that browsing the web from an Administrator account is what caused the issue, accompanied with clicking "Yes" "Accept" and "Allow" at every box which pops up in front of them?

I've worked for ISPs here in Sweden and most serious ISPs here see it as standard practice to warn and then disconnect users who are running zombie machines, nothing strange or totalitarian about it, it's about protecting their network and their other customers from harm.

I've worked for ISPs here in Sweden and most serious ISPs here see it as standard practice to warn and then disconnect users who are running zombie machines, nothing strange or totalitarian about it, it's about protecting their network and their other customers from harm.

It certainly makes sense, but what happens next ? How do most clueless users manage to clean their machines, with no network access ? And how do they get their access back ? What's the process to certify their rig as being "clean" ? Or has a "home Windows cleaning" (no, not those windows) industry sprung up to meet the demand ?

Warning, user told to clean up machine and informed that further complaints or indications or malware infestation would result in temporary disconnection.

Temporary disconnection until the user contacted us and said he/she had fixed the problem.

If we reconnect the user and the problem persists, the user's connection is once again disabled and the user is told to have his/her machine properly examined and fixed by a computer store or similar professiona

The idea is good because it would it that much harder to propagate botnets and even feasible, but the real problem is that almost all end users have no idea what malware is or how to stop it. Unless the enduser is supported in removing the malware, and in the case of rootkits this usually means reinstalling the OS, then it will only result in a huge number of complaints that the ISPs will not be able to cope with.

The idea is good because it would it that much harder to propagate botnets and even feasible, but the real problem is that almost all end users have no idea what malware is or how to stop it. Unless the enduser is supported in removing the malware, and in the case of rootkits this usually means reinstalling the OS, then it will only result in a huge number of complaints that the ISPs will not be able to cope with.

Most end users have no idea how to replace the spin motor on their washing machine, either.

I don't understand why people who are perfectly happy with getting knowledgeable technicians to work on almost all of their household equipment think that their PC is some sort of magical exception.

I don't understand why people who are perfectly happy with getting knowledgeable technicians to work on almost all of their household equipment think that their PC is some sort of magical exception.

That one is easy.

Microsoft (and Apple) keep pushing the idea that computers and essentially their operating systems and software are super simple. Pah, a child a 5 could get this (fetch me a child of 5 !).People here know that it's actually horrendously complex and that it's often a miracle that it works at all, especially if we let users tinker with the stuff, but marketers have to sell their wares, so that kind of talk just won't do. So they lie through their teeth (they're trained to do this from a young

Well, quite. It doesn't help that Microsoft have conditioned people to ignore these warnings as being totally unimportant, and at the same time have worded them so badly that most people never even try to understand them, they just hammer away trying to find a way to do what they want without the warning coming up.

I've actually met IT professionals who seem to think that doing this is the correct way to troubleshoot a problem. Shoot me now...

When my car's "check engine" light comes on, there is almost always a real problem. When my computer pops up its warning, it might be something serious or it might mean I need to enter a password, or it might be attention-whoring from my AV program. To be useful, PC warnings have to be rare events that only happen when your machine really does need attention, not things that happen all the time.

I'm in the UK and used to use Zen as my ISP. I found their tech support very helpful in spotting dodgy activity emanating from my home network and advising me on ways to investigate and correct my problems. They did warn that I should take immediate action or they would have to consider suspending my connection. I found this a sensible, helpful and mature approach to the situation.

If done properly involvement of the ISP in identifying and helping resolve infected PCs should be welcomed I would have thought

This isn't suggesting the ISP's make any decisions, just to apply a new set of rules and have a procedure for disconnection. I suffered for weeks some years back from what looked like DoS attacks and masses of Spam which was largely coming from a single Internet Cafe on George St Sydney. I first spoke to the owner, who basically told me to get stuffed with what I assume were Chinese profanities chucked in for good measure. I appealed to him a few more times to at least try and clean up his machines, he told

ISPs should just provide internet access not police and monitor traffic.

Yeah, and if they help my neighbour get rid of their malware, there will be less useless (even harmful) traffic clogging up the pipes I want to use.

Even though I get along well with the "privacy paranoid" group, I think it's reasonably for ISPs to monitor for malware/spam traffic, and contact the users who get hit by it (which in many cases is through no fault of their own), tell them what's going on and offer help changing the situation.

That's good for the malware-infected customer; it gives the ISP a bett

Exactly, who wants a random sample of your 'up' data read in plain text?
We (your isp to the court) where looking for malware and noted that 'you' where distributing pornography. eg possession of any content classified RC (Refused Classification) a criminal offence.

Rogers, here in Canada, has been practising this for a few years now, and will notify and disconnect computers that are sending network packets that match known malware. I think it's an automated process, too.

It's sort of funny, there was once a time when someone set the DHCP lease length too short, and several customers wrongly got blasted off the internet as they had been "infected".

A couple of years ago, a major ISP in Finland had a somewhat similar system. They wouldn't allow infected computers to take any other network access than HTTP and they redirected all HTTP traffic to a page saying "you're infected" and providing short instructions on how to fix it. It seems that they're not doing it anymore, but I don't know the reason.

I am guessing that the people who got infected probably saw the "you're infected" page as being normal [per earlier slashdot article] and once they realized they couldn't go anywhere else they blamed the ISP for it and went elsewhere.

A couple of years ago, a major ISP in Finland had a somewhat similar system. They wouldn't allow infected computers to take any other network access than HTTP and they redirected all HTTP traffic to a page saying "you're infected" and providing short instructions on how to fix it. It seems that they're not doing it anymore, but I don't know the reason.

The largest ISP in Finland, Elisa is still doing it and the system is actually working very well. I haven't seen a single false positive yet (yes I work in their helpdesk).

I've contacted ISP's about their customers attempting to "hack me" because they were infested with Code Red and Nimda and for some reason my Apache server on Linux looked incredibly tasty. They of course proceeded to ignore me and not even to contact their customers.

i always enjoyed seeing those in my snort logs, or even the logs in my pix in later years. And yes, I'd send the sniffer trace to the abuse address of the isp, never made a damn bit of difference. This is what infuriates me about consumer isps. If one of my clients who buys service from me started to get sniffer trace emails to my abuse mailbox, i'd be on the phone at the least.

I've contacted ISP's about their customers attempting to "hack me" because they were infested with Code Red and Nimda and for some reason my Apache server on Linux looked incredibly tasty. They of course proceeded to ignore me and not even to contact their customers.

I had a similar experience at University. I was living on campus and had my Apache server running along nicely on my Linux box, and kept on getting these weird error logs. As soon as I saw it I had a feeling that it was Code Red, so I checked up on the net just to confirm. It was. So I then traced it back to its source - one of the University's own computers. I contacted the Uni's IT staff and informed them that they had a machine that was infected with Code Red. Do you know what response they gave me?

"It isn't our machine that is infected. Your machine is the infected one."

For anyone who didn't read the above properly, or can't be bothered going back over it again, I was running Apache on Linux and the Code Red worm infected Microsoft IIS Web Servers.

Want to put a stop to malware/botnets?
This is it.
If a simple email/phone call asking "are you using irc/running your own mail server?" gets a response of "I don't know what irc is!", shut them down until they can clean out their machines, hell, even give them help, such as redirecting them to an isp sponsored AV or something (and no, i'm not talking enforcing it like some schools do with clean access or other network admission control.) Doing this sensibly could very seriously take a bite of out a lot of the problems on the 'net today.

Having sold "unlimited" access at a fixed price, ISPs run on tight margins, so one simple email or phone call, plus the subsequent dealing with the customer, will wipe out the whole year's profit from that customer. So what in practice will happen if ISPs go down this route is that they will simply start blocking the ports for IRC and mail. And then the malware will move to another protocol, and that will be blocked, and so on.

I suspect the the law of unintended consequences will mean that we'll end up with ISPs that provide access only to http and https.

I suspect the the law of unintended consequences will mean that we'll end up with ISPs that provide access only to http and https.

Or the unintended consequence will be that (shock horror) ISPs will only sell what they're actually able to sell, and people won't be expecting "all you can eat" Internet access for £5 per month! You want excessively more bandwidth than is the norm? Pay for it.

My (Australian) ISP has been doing this at least for spam relays for a few years now. If they detect you are being used to spam they cut all your traffic and redirect port 80 to a page telling you what has happened and giving you links to AV tools and an automated traffic checker that will unblock you once you have dealt with the malware. Two of the guys I live with got infected and so I have personal experience dealing with the system. To me it seems like a perfectly sensible and responsible reaction to a serious problem. IMO any ISP not doing this is an irresponsible netizen.

To me it is like your CC company notifying you of suspicious charges or the phone company asking why your mobile is suddenly making hundreds of calls from Azerbaijan. It not only stops the current problem but if people are actually notified that they have a problem they are far more likely to take steps to protect themselves in the future.

EXETEL are a one of the best ISP's down here. The only problem with them is that the network is getting so saturated these days (none of the major telcos will invest in new capacity until the Aussie government sorts out its 10 billion AUD future broadband scheme) that they are shaping P2P and limiting "bonus" data to 3am to 8am. Kind of sucks but the other option is for all traffic to be slow if the links max out due to unrestricted P2P.

Other than the network capacity issue they are pretty "wink wink nudge

Exetel also conducted a trial of its own [exetel.com.au] in regard to ISP level web filtering technologies.
It made participation in this trial mandatory for all of its subscribers, disallowing them the freedom to opt-out.
There's some food for thought.

I know when I was living on campus at a state university my computer was caught in one of their malware scans. I was running Linux and had firewalled ping requests among other things. Their scanning system automatically assumed if a computer did not respond to ping it was infected.

You wouldn't need to scan the computer. Just watch for the network traffic signature of malware (eg. open ports known to belong to malware that respond to the appropriate malware's protocol when probed, or open ports belonging to a Web server serving up malware). My ISP already scans for open ports as a regular security precaution. As for opt-out, no. The people who are the most problem are exactly the ones who'd opt out instead of fixing the problem (because in their mind the problem isn't the malware, it'

It is frustrating to lose access to my home server while at work and not be able to do any troubleshooting because I need physical access to the machine.

It is quite maddening to finally get home, verify that there is nothing wrong on my end, call up support and (eventually) find out that I've been deliberately disconnected because of a security problem that doesn't exist.

EVERY country needs to be doing this, and not making it voluntary either. Any problem on the internet affects everyone connected to it. Cutting off PCs in one country has limited effect in isolation. Considering botnets are an exclusive Windows problem, Microsoft should be forced to pay for the scheme too. It's their mess after all.

I'm curious about how MS will respond to this if it comes into being. On one hand they'll lose a large number of users, after all, does anyone outside the MS camp really believe that it's not gonna be 100% infected Windows PC's that will be affected? What will MS do?

Will they offer discounted or free vouchers for repairs, upgrades etc? How many of these machines will be unlicensed? Will they pay to fix unlicensed copies of Windows if the owners either have no money to spend on a sticker with a number on it? In the current economic climate you can't blame them. Is a subsidy to clean the PC worth the ISP's time and hassle knowing it'll be infected again by the end of the week at the latest, and they'll have to repeat the same warning and threat of disconnection all over again. Will they provide paid anti-malware software? Who pays for all of this? Will they provide training for Windows users to at least give them a chance of having a few months online without a letter?

This would reflect badly on MS in any free press, even having to be the only ones to offer fixes is embarrassing enough. Given that MS control the mainstream media it'll go unnoticed as far as PR is concerned, but it's yet one more thing eating into their profits at a time where they're struggling.

The alternative is to lose a large number either to Linux, or off the internet altogether. Anyone who's had the internet for a while knows what it's like when it goes down for a few hours, will those people really decide the internet is not worth it?

I'm guessing the great philanthropists and all round nice people at MS are busy lobbying at every level to stop this from happening or at least water it down (notice the ISPs are being "asked" not "told"). They need to keep market share by any means necessary, ideally without spending a cent on it. The rest of the world can suffer as long as MS's interests are not hurt.

Given that Windows has all the security of a paper tank in a thunderstorm this will be hilarious to see the workload the scheme entails, and over time the number of Windows PCs in Australia still connected because they're NOT infected. They will drop like flies. Give it a few years and it'll be a Windows free zone.

Given the story a few days back about the Linux botnet, and this [slashdot.org] story a few months ago about the Mac botnet... The real problem is education, idiots will be idiots no matter what platform they use.

Indeed, the recent story about ONE Linux botnet, and another recent story about ONE Mac botnet is equal to the 100's if not 1,000's of ACTIVE Windows botnets, past, present and future. As much as Microsoft enjoy a good monopoly when it's their name on the door, this is one they earned without corruption by making terrible software.

90% of security holes that have been exploited in the last few years are sitting on the chair in front of the computer. Even if Windows were to evaporate overnight and everyone using it were magically switched to a Mac or to Linux, inside a few weeks you'd see malware pop up which has Apple logos and Linux penguins and makes reassuring noises while insisting it really does need your password.

WHich the dump user will gladly use to install the package giving him access to the latest porn or some bettre video codec or some new chat emoticons.
Under windows, most malware is installed by software USER WILLINGLY INSTALL. That wont change under Linux a bit - dump users will leanr to install software. Not for their new word processor, no - because they absolutly NEED that new emoticons in their favourite chat software.

EVERY country needs to be doing this, and not making it voluntary either. Any problem on the internet affects everyone connected to it. Cutting off PCs in one country has limited effect in isolation. Considering botnets are an exclusive Windows problem, Microsoft should be forced to pay for the scheme too. It's their mess after all.

Um, not exactly. Evidence of Linux botnets [computerworld.com] and OS X variants with confirmed infections in the wild. Methinks you're buying a bit too much into the late 90s / early 2000s era FUD against Microsoft. Maybe if this was ten years ago your sabre-rattling might have been acceptable. But these days, to categorically deny the leaps and bounds at which Microsoft has improved security in both Windows Vista and Windows 7, and not realizing that malware is more and more becoming a user education problem than anythin

I agree with you, we do need to put it in perspective.ONE small Linux botnet found recently because of badly configured systems? It's a tiny drop in the ocean. Is that in any way close to sharing blame with Windows for their 1,000's of LARGE botnets being actively used? Microsoft like to spread FUD about Windows market share being almost total, with Linux and OSX hardly getting a mention. They're right, but it seems they're talking about the botnet scourge ALL PC users have to suffer, regardless of our choi

Um, not exactly. Evidence of Linux botnets [computerworld.com] and OS X variants with confirmed infections in the wild.

The 'botnet' consisted of about 100 Linux servers, none of whom could be proven to have been infected via automated means. Indeed, the man who discovered this threat speculated that they were compromised by sniffing FTP passwords. Not included in the report was how many actual machines were compromised. Individual Linux web servers can host hundreds of accounts or more.

Why not make it compulsory to get networkable devices certified to be malware-free every year just as cars need to go through statutory vehicle inspections?
If bandwidth is such an important resource, shouldn't we consider networkable devices to be potentially dangerous and perhaps consider the idea of requiring a license for ownership?

Do you really want a government bureaucrat picking through your hard disk deciding what is malware and what isn't? Would the government even have technicians capable of determining whether your linux install is malware or not?

The option to disable port blocking is given on their website, and changes take effect within 15 min. This blocks the propagation of malware without running the risk of accidentally disconnecting users on false positive

If you are disconnected for being malware infected, exactly what WILL be the process for being reconnected, assuming you aren't just black listed for life as an internet persona non grata? Will it be some byzantine bureaucratic DMV-like red tape nightmare with hundreds, even thousands of people showing up every day as botnets simply infect more and more systems to make up for those it lost during the morning disconnect purge?